Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13-10-2024 16:17

General

  • Target

    d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe

  • Size

    1023KB

  • MD5

    a94a15d740a2376466bb3675d773af18

  • SHA1

    23cbf5cba6ea5035ea11aef35267f2fbd70e8bd0

  • SHA256

    d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d

  • SHA512

    fce4e43f007c80d7baae3420ee5db2d351732cac50442c1d7047200bb4d35628cca19a440881c70a83666d49b4050d134e7009975f7aad6e0593584388300ede

  • SSDEEP

    24576:6Jjxg3canLNil/0bZjxrpaULxkKY46EFnGzwkcL7O:6xxg3canLNierpaGpY46kiwkcLi

Malware Config

Extracted

Family

vidar

Version

11.1

Botnet

191375c1805c0d5109ea6297d63371b2

C2

https://steamcommunity.com/profiles/76561199786602107

https://t.me/lpnjoke

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Signatures

  • Detect Vidar Stealer 13 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
    "C:\Users\Admin\AppData\Local\Temp\d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Users\Admin\AppData\Local\Temp\d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      "C:\Users\Admin\AppData\Local\Temp\d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe"
      2⤵
        PID:1284
      • C:\Users\Admin\AppData\Local\Temp\d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
        "C:\Users\Admin\AppData\Local\Temp\d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe"
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2384
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AKKKFBGDHJKF" & exit
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:988
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 10
            4⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:2552

    Network

    • flag-us
      DNS
      steamcommunity.com
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      8.8.8.8:53
      Request
      steamcommunity.com
      IN A
      Response
      steamcommunity.com
      IN A
      104.82.234.109
    • flag-gb
      GET
      https://steamcommunity.com/profiles/76561199786602107
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      104.82.234.109:443
      Request
      GET /profiles/76561199786602107 HTTP/1.1
      Host: steamcommunity.com
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Content-Type: text/html; charset=UTF-8
      Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
      Expires: Mon, 26 Jul 1997 05:00:00 GMT
      Cache-Control: no-cache
      Date: Sun, 13 Oct 2024 16:17:22 GMT
      Content-Length: 34950
      Connection: keep-alive
      Set-Cookie: sessionid=507065901dcd0c13fcd76b77; Path=/; Secure; SameSite=None
      Set-Cookie: steamCountry=GB%7Ce15d564837abb028acb4e114150d704d; Path=/; Secure; HttpOnly; SameSite=None
    • flag-de
      GET
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:22 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JEBKEHJJDAAAAKECBGHD
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 255
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:23 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBF
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:24 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----FCAAEHJDBKJJKFHJEBKF
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:24 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 332
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:25 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JKKFIIEBKEGIEBFIJKFI
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 4957
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:26 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      GET
      https://116.203.12.50/sqlp.dll
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      GET /sqlp.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:26 GMT
      Content-Type: application/octet-stream
      Content-Length: 2459136
      Connection: keep-alive
      Last-Modified: Sunday, 13-Oct-2024 16:17:26 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      GET
      https://116.203.12.50/freebl3.dll
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      GET /freebl3.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:28 GMT
      Content-Type: application/octet-stream
      Content-Length: 685392
      Connection: keep-alive
      Last-Modified: Sunday, 13-Oct-2024 16:17:28 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      GET
      https://116.203.12.50/mozglue.dll
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      GET /mozglue.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:29 GMT
      Content-Type: application/octet-stream
      Content-Length: 608080
      Connection: keep-alive
      Last-Modified: Sunday, 13-Oct-2024 16:17:29 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      GET
      https://116.203.12.50/msvcp140.dll
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      GET /msvcp140.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:29 GMT
      Content-Type: application/octet-stream
      Content-Length: 450024
      Connection: keep-alive
      Last-Modified: Sunday, 13-Oct-2024 16:17:29 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      GET
      https://116.203.12.50/softokn3.dll
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      GET /softokn3.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:31 GMT
      Content-Type: application/octet-stream
      Content-Length: 257872
      Connection: keep-alive
      Last-Modified: Sunday, 13-Oct-2024 16:17:31 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      GET
      https://116.203.12.50/vcruntime140.dll
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      GET /vcruntime140.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:35 GMT
      Content-Type: application/octet-stream
      Content-Length: 80880
      Connection: keep-alive
      Last-Modified: Sunday, 13-Oct-2024 16:17:35 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      GET
      https://116.203.12.50/nss3.dll
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      GET /nss3.dll HTTP/1.1
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:36 GMT
      Content-Type: application/octet-stream
      Content-Length: 2046288
      Connection: keep-alive
      Last-Modified: Sunday, 13-Oct-2024 16:17:36 GMT
      Cache-Control: no-store, no-cache
      Accept-Ranges: bytes
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----GHIJJEGDBFIIDGCAKJEB
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 905
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:51 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----ECBGCBGCAFIIECBFIDHI
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:39 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----HJEBGHIEBFIJKECBKFHD
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:17:58 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-us
      DNS
      crl.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      crl.microsoft.com
      IN A
      Response
      crl.microsoft.com
      IN CNAME
      crl.www.ms.akadns.net
      crl.www.ms.akadns.net
      IN CNAME
      a1363.dscg.akamai.net
      a1363.dscg.akamai.net
      IN A
      2.19.117.18
      a1363.dscg.akamai.net
      IN A
      2.19.117.22
    • flag-us
      DNS
      crl.microsoft.com
      Remote address:
      8.8.8.8:53
      Request
      crl.microsoft.com
      IN A
    • flag-gb
      GET
      http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
      Remote address:
      2.19.117.18:80
      Request
      GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      If-Modified-Since: Thu, 11 Jul 2024 01:45:51 GMT
      User-Agent: Microsoft-CryptoAPI/6.1
      Host: crl.microsoft.com
      Response
      HTTP/1.1 200 OK
      Content-Length: 1036
      Content-Type: application/octet-stream
      Content-MD5: 8M9bF5Tsp81z+cAg2quO8g==
      Last-Modified: Thu, 26 Sep 2024 02:21:11 GMT
      ETag: 0x8DCDDD1E3AF2C76
      Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
      x-ms-request-id: b28c4ea1-d01e-0016-0ebc-0fa13d000000
      x-ms-version: 2009-09-19
      x-ms-lease-status: unlocked
      x-ms-blob-type: BlockBlob
      Date: Sun, 13 Oct 2024 16:18:04 GMT
      Connection: keep-alive
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----KFBGCAKFHCFHJKECFIID
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 461
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:18:17 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-us
      DNS
      www.microsoft.com
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      8.8.8.8:53
      Request
      www.microsoft.com
      IN A
      Response
      www.microsoft.com
      IN CNAME
      www.microsoft.com-c-3.edgekey.net
      www.microsoft.com-c-3.edgekey.net
      IN CNAME
      www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
      www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
      IN CNAME
      e13678.dscb.akamaiedge.net
      e13678.dscb.akamaiedge.net
      IN A
      23.44.65.132
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----AEHIECAFCGDBFHIDBKFC
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 81533
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:18:18 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----HCFBAFIDAECAKFHJDBAF
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:18:20 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-us
      DNS
      nsdm.cumpar-auto-orice-tip.ro
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      8.8.8.8:53
      Request
      nsdm.cumpar-auto-orice-tip.ro
      IN A
      Response
    • flag-us
      DNS
      nsdm.cumpar-auto-orice-tip.ro
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      8.8.8.8:53
      Request
      nsdm.cumpar-auto-orice-tip.ro
      IN A
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGH
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 499
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:18:26 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-de
      POST
      https://116.203.12.50/
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      116.203.12.50:443
      Request
      POST / HTTP/1.1
      Content-Type: multipart/form-data; boundary=----GHIJJEGDBFIIDGCAKJEB
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
      Host: 116.203.12.50
      Content-Length: 331
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Sun, 13 Oct 2024 16:18:27 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-us
      DNS
      cowod.hopto.org
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      8.8.8.8:53
      Request
      cowod.hopto.org
      IN A
      Response
    • flag-us
      DNS
      cowod.hopto.org
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      8.8.8.8:53
      Request
      cowod.hopto.org
      IN A
    • flag-us
      DNS
      cowod.hopto.org
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      Remote address:
      8.8.8.8:53
      Request
      cowod.hopto.org
      IN A
    • 104.82.234.109:443
      https://steamcommunity.com/profiles/76561199786602107
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      1.5kB
      42.3kB
      23
      37

      HTTP Request

      GET https://steamcommunity.com/profiles/76561199786602107

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      1.4kB
      2.1kB
      9
      8

      HTTP Request

      GET https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      1.2kB
      762 B
      8
      7

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      1.3kB
      2.3kB
      8
      8

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      1.4kB
      6.5kB
      10
      11

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      1.3kB
      810 B
      8
      7

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      6.2kB
      1.1kB
      13
      11

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/sqlp.dll
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      44.6kB
      2.5MB
      958
      1834

      HTTP Request

      GET https://116.203.12.50/sqlp.dll

      HTTP Response

      200
    • 116.203.12.50:443
      tls
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      1.4kB
      698 B
      8
      7
    • 116.203.12.50:443
      https://116.203.12.50/freebl3.dll
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      12.6kB
      709.5kB
      263
      518

      HTTP Request

      GET https://116.203.12.50/freebl3.dll

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/mozglue.dll
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      11.3kB
      629.5kB
      234
      458

      HTTP Request

      GET https://116.203.12.50/mozglue.dll

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/msvcp140.dll
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      18.6kB
      474.2kB
      306
      347

      HTTP Request

      GET https://116.203.12.50/msvcp140.dll

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/softokn3.dll
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      5.5kB
      271.6kB
      107
      202

      HTTP Request

      GET https://116.203.12.50/softokn3.dll

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/vcruntime140.dll
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      2.7kB
      84.4kB
      42
      69

      HTTP Request

      GET https://116.203.12.50/vcruntime140.dll

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/nss3.dll
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      57.5kB
      2.2MB
      1010
      1549

      HTTP Request

      GET https://116.203.12.50/nss3.dll

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      7.8kB
      774 B
      15
      8

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      1.7kB
      4.1kB
      12
      9

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      5.0kB
      5.7kB
      19
      12

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 2.19.117.18:80
      http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
      http
      551 B
      1.8kB
      7
      5

      HTTP Request

      GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      2.1kB
      1.1kB
      15
      11

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      85.4kB
      2.3kB
      73
      42

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      2.1kB
      1.2kB
      10
      8

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      1.6kB
      1.2kB
      10
      8

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 116.203.12.50:443
      https://116.203.12.50/
      tls, http
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      1.4kB
      875 B
      9
      7

      HTTP Request

      POST https://116.203.12.50/

      HTTP Response

      200
    • 8.8.8.8:53
      steamcommunity.com
      dns
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      64 B
      80 B
      1
      1

      DNS Request

      steamcommunity.com

      DNS Response

      104.82.234.109

    • 8.8.8.8:53
      crl.microsoft.com
      dns
      126 B
      162 B
      2
      1

      DNS Request

      crl.microsoft.com

      DNS Request

      crl.microsoft.com

      DNS Response

      2.19.117.18
      2.19.117.22

    • 8.8.8.8:53
      www.microsoft.com
      dns
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      63 B
      230 B
      1
      1

      DNS Request

      www.microsoft.com

      DNS Response

      23.44.65.132

    • 8.8.8.8:53
      nsdm.cumpar-auto-orice-tip.ro
      dns
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      150 B
      140 B
      2
      1

      DNS Request

      nsdm.cumpar-auto-orice-tip.ro

      DNS Request

      nsdm.cumpar-auto-orice-tip.ro

    • 8.8.8.8:53
      cowod.hopto.org
      dns
      d6f89f9ab4ae1eddc852c3b78f13914db23cef1cb010f2e863a2a6172722c34d.exe
      183 B
      121 B
      3
      1

      DNS Request

      cowod.hopto.org

      DNS Request

      cowod.hopto.org

      DNS Request

      cowod.hopto.org

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      242B

      MD5

      2ad7c7c9f0a73ef99a90b4cd0c35ad0c

      SHA1

      8448d74d063c11e454dff485c91d261d732ffd27

      SHA256

      2efd467ec1e0328126745fc4ec98c095742e9d1b2c331df7a82d11b973eb713d

      SHA512

      75bbd82ec1b99e077f5b29ee8b412cbb3e79660c9ff371369b81544bdb552b7a69f5a0569fb8b512146eeef55f3a1dd774022496fc7176af30dc8178aa4e0a59

    • C:\Users\Admin\AppData\Local\Temp\Cab958D.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Tar95B0.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • \ProgramData\mozglue.dll

      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

    • \ProgramData\nss3.dll

      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

    • memory/1748-0-0x00000000002EA000-0x00000000002EB000-memory.dmp

      Filesize

      4KB

    • memory/2384-202-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-1-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-191-0x0000000020840000-0x0000000020A9F000-memory.dmp

      Filesize

      2.4MB

    • memory/2384-11-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2384-14-0x00000000001F0000-0x00000000002F4000-memory.dmp

      Filesize

      1.0MB

    • memory/2384-153-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-172-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-3-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-4-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-5-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-221-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-9-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-352-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-413-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-414-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-437-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-2-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    • memory/2384-6-0x0000000000400000-0x0000000000676000-memory.dmp

      Filesize

      2.5MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.